Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from CarolinaCon, but am looking for a more detailed/visual demo of how to apply it in web app pen-testing. In addition, I have seen other vulnerable web apps such as Damn Vulnerable Web App and Webgoat, as well as a few others, but can't seem to find how an attacker can exploit a format string vulnerability via a web browser and how to protect against it, other than modifying the code of the vulnerable link and/or program.
This all stems from reading different external scanning reports that always seem to contain Format String Vulnerability located at www.domainname.com/default.asp?(insert name here and code, ex.) News=%2508x. What exactly should I be looking for and how is someone supposed to investigate/test this (tools, manual, etc.)?